Privacy policy

Who is the controller

Machinefixes is the data controller for the personal information described in this policy. The service is operated from the European Union and the underlying database is hosted on EU-resident infrastructure, so the GDPR is our baseline — not a ceiling.

You can reach the data controller for any privacy question, request, or complaint at the address listed in the Contact section at the bottom of this page.

What we collect

We collect only what is needed to run the service. Six categories of data sit in our database, plus one strictly-anonymous visitor beacon that is set by your browser.

• Account data — email, display name, and password hash (via better-auth) on User; session tokens on Session; OAuth provider details on Account.
• Work-order records — work orders, failures, and repairs you create, including machine label and family, observed symptoms, procedure text, parts replaced, minutes spent, and outcome (verified, provisional, worked, partial, or did not work).
• Repair photos — images you upload against a repair, stored on Cloudflare R2 and referenced by an opaque key from the RepairPhoto model. The upload route is /api/uploads; URLs are signed by src/lib/business/photo-url.ts.
• Symptom-search queries — the search text you submit, the filters you applied, and the result set we returned, retained for ranking and abusability review.
• Community signals — votes and community notes you attach to entries on the ingest side of the service.
• Billing receipts — order and subscription records needed to fulfil your payment and to keep our tax records straight. Card details never reach our database: they are taken and held by Stripe.
• Visitor beacon — a single random UUID (polsia_vid) written to your browser’s localStorage by src/components/polsia-analytics.tsx. It contains no personal information; it lets us de-duplicate page-view counts. No cookies are set, no fingerprinting is performed, and the beacon does not leave the polsia.com measurement host.

Why we collect it, and our legal basis

Every category above has a purpose, and every purpose has a GDPR legal basis. We rely on three of the six grounds the regulation recognises, and we name them here so you can challenge any one of them.

• Contract — account data, work-order records, repair photos, and symptom-search queries are needed to deliver the service you signed up for. Without them the product cannot function.
• Legitimate interest — community signals (votes and notes), billing receipts (where we retain them for audit), and the visitor beacon (aggregate, non-personal traffic measurement) are processed on a balancing test: we measure the interest against your rights, and we have set each one up so the balance favours the service operation that you have implicitly opted into by using it.
• Consent — anything we add later that does not fit the first two categories opens with a consent prompt. No consent-gated feature is live today.

How we store and process it

All account, work-order, ingest, and billing data lives in a single Postgres database hosted on EU-resident infrastructure managed by the Polsia platform. Backups are encrypted at rest and held in the same jurisdiction.

Photos are stored on Cloudflare R2, an EU-resident object store, and are referenced from the RepairPhoto model by an opaque key. Server code goes through a single signed-URL helper; bare R2 URLs are never exposed.

Payments are processed by Stripe; card details, fraud signals, and payout routing are handled inside their infrastructure under their own data-protection terms. We retain only what Stripe sends us back: order id, amount, currency, plan, and Stripe’s event id.

The web application itself is served through Cloudflare’s edge; page-load beacons hit the same provider under the polsia.com measurement host. We do not use any other analytics or advertising tracker, and we do not embed any third-party advertising code.

How long we keep it

Retention is per category. We do not promise a universal deletion window because the windows are different for different data, and a single number would either over-retain or destroy records we are legally obliged to keep.

• Account data and sessions — for the life of your account, plus 30 days after a deletion request so accidental deletions are recoverable; sessions expire on the date set by better-auth’s session config.
• Work-order records, failures, repairs, and photos — for the life of the account, because the past-fix retrieval loop is the product. If you ask us to delete your account we will erase these along with it.
• Billing receipts — seven years from the date of the transaction, to satisfy EU accounting record-keeping obligations.
• Symptom-search queries — 90 days from the query, after which only the aggregate rank-evaluation signal is retained.
• Visitor beacon — the localStorage entry is held for 12 months or until you clear site data; we do not see or set it again until the next visit.

Your rights

The GDPR grants you a defined set of rights against any controller of your personal data. We honour each of them, without fee, within the statutory one-month window (extendable by one further month for complex requests, with notice).

• Access — request a copy of the personal data we hold about you, in a portable format.
• Rectification — ask us to correct anything that is wrong or incomplete.
• Erasure — ask us to delete your personal data, subject to the legal retention exceptions described above (notably billing receipts).
• Restriction — ask us to suspend processing of particular fields while a dispute is resolved.
• Portability — receive the data you gave us in a machine-readable form so you can move it elsewhere.
• Objection — object to processing that runs on our legitimate-interest grounds; we will either stop the processing or demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent — for any future consent-based feature, at any time, without affecting the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

Write to us at the contact address below. Include enough information for us to identify you (the email on your account is enough), and describe the right you would like to exercise. We will acknowledge within five working days and complete the request within the statutory one-month window.

If you are unhappy with our response, you have the right to lodge a complaint with your national data-protection authority. As the controller is established in the European Union, the lead supervisory authority will be the one in the controller’s country of establishment.

Changes to this policy

We will post material changes on this page and update the effective date and version number at the top. Non-material edits (typos, clarifications that do not change the substance) will not be announced individually. The current version is always the one displayed on this page; please check back before relying on a stale copy.